Earlier quoted context omitted.
Windows 10, spying on its user, is malware.
A domain like 'microsft.com' is used to trick users into thinking the communication is legitimate and to Microsoft. But why would the actual Microsoft need to engage in this?
Any user-facing names obviously get reviewed by the whole departments that are dedicated to ensuring it fits with the brand, translates well into all languages, not offensive to anyone, etc.
For identifiers that are not expected to be user facing, they're likely to get code review, simple profanity filters, and certificate policy checks, plus whatever bikeshedding those particular dev+ops+networking teams want to have about it. For a service endpoint that's really only resolved in the guts of client code, I could easily imagine an individual dev just using an arbitrary name for the prototype, and then eventually finding that the service became useful and that it's just not worth updating all the existing clients for a cosmetic change mostly no one sees.
Also, you hear conversations like "so-and-so registered that name years ago for idea X, but that didn't really go anywhere, so we can just repurpose that since we know that it's both already working and unused".
So I wouldn't read any particular motivation into 'microsft.com'.